mixdog 1.0.7 → 1.0.9

package/src/runtime/memory/lib/cycle1/cycle1-rows.mjs

@@ -4,7 +4,31 @@
 // terminal / omitted sentinel updates.
 import { __mixdogMemoryLog } from '../memory-log.mjs';
 import { throwIfAborted } from '../memory-cycle-shared.mjs';
-import { CYCLE1_OMITTED_COOLDOWN_MS } from './cycle1-plan.mjs';
+import { CYCLE1_OMITTED_COOLDOWN_MAX_MS, CYCLE1_OMITTED_COOLDOWN_MS } from './cycle1-plan.mjs';
+
+const CYCLE1_OMITTED_MAX_DOUBLINGS = Math.ceil(Math.log2(CYCLE1_OMITTED_COOLDOWN_MAX_MS / CYCLE1_OMITTED_COOLDOWN_MS));
+
+/** SQL for "this unchunked row may be sent now": never reviewed, or its
+ *  cooldown has passed. The cooldown starts at CYCLE1_OMITTED_COOLDOWN_MS and
+ *  doubles with each further miss counted in error_count, up to the maximum.
+ *  `nowParam` is the placeholder holding the current time in ms. */
+export function cycle1RowDueSql(nowParam, alias = '') {
+  const column = alias ? `${alias}.` : '';
+  const doublings = `LEAST(GREATEST(COALESCE(${column}error_count, 0) - 1, 0), ${CYCLE1_OMITTED_MAX_DOUBLINGS})`;
+  const cooldown = `LEAST(${CYCLE1_OMITTED_COOLDOWN_MAX_MS}::bigint, ${CYCLE1_OMITTED_COOLDOWN_MS}::bigint * (1::bigint << ${doublings}))`;
+  return `(${column}reviewed_at IS NULL OR ${column}reviewed_at < ${nowParam}::bigint - ${cooldown})`;
+}
+
+/** SQL for "an unchunked row that belongs to a session". `session_id IS NOT
+ *  NULL` is implied by the trimmed check; stating it is what lets the planner
+ *  use the partial index on pending rows. Without it every count scanned the
+ *  whole table, and the backlog probe alone runs two a minute (EXPLAIN ANALYZE
+ *  on a 162K-row store: parallel seq scan, 100-170 ms and 21K blocks read,
+ *  against 32 ms through the index). */
+export function cycle1UnchunkedSql(alias = '') {
+  const column = alias ? `${alias}.` : '';
+  return `${column}chunk_root IS NULL AND ${column}session_id IS NOT NULL AND NULLIF(btrim(${column}session_id), '') IS NOT NULL`;
+}
 
 export function isStructurallyUnchunkableInput(row) {
   return !String(row?.content ?? '').trim();
@@ -41,19 +65,23 @@ export async function markTerminalRows(db, rowIds, label = 'terminal') {
   }
 }
 
-export async function markOmittedRows(db, rowIds) {
+/** Defers the rows a window left raw. Only a miss the classifier produced
+ *  counts toward the lengthening cooldown (cycle1RowDueSql); `transientRowIds`
+ *  never got an answer — a provider error, a commit that lost a race — and
+ *  come back at the base cooldown however long the outage lasts. */
+export async function markOmittedRows(db, rowIds, { transientRowIds = [] } = {}) {
   const ids = positiveEntryIds(rowIds);
   if (ids.length === 0) return { attempted: 0, deferred: 0, marked: 0, failed: 0 };
   try {
     const result = await db.query(
       `UPDATE entries
        SET reviewed_at = $2,
-           error_count = COALESCE(error_count, 0) + 1
+           error_count = COALESCE(error_count, 0) + CASE WHEN id = ANY($3::bigint[]) THEN 0 ELSE 1 END
        WHERE id = ANY($1::bigint[])
          AND chunk_root IS NULL
          AND is_root = 0
        RETURNING id`,
-      [ids, Date.now()]
+      [ids, Date.now(), positiveEntryIds(transientRowIds)]
     );
     const rows = Array.isArray(result?.rows) ? result.rows : [];
     // A model failure is not permission to retire source data. Keep every
@@ -81,12 +109,12 @@ export function selectRootId(members) {
   return rootId;
 }
 
-async function countSessionUnchunkedRows(db, { reviewedBefore = null } = {}) {
-  const where = ['chunk_root IS NULL', `NULLIF(btrim(session_id), '') IS NOT NULL`];
+async function countSessionUnchunkedRows(db, { dueAt = null } = {}) {
+  const where = [cycle1UnchunkedSql()];
   const params = [];
-  if (reviewedBefore != null) {
-    params.push(reviewedBefore);
-    where.push('(reviewed_at IS NULL OR reviewed_at < $1)');
+  if (dueAt != null) {
+    params.push(dueAt);
+    where.push(cycle1RowDueSql('$1'));
   }
   try {
     const result = await db.query(
@@ -102,7 +130,7 @@ async function countSessionUnchunkedRows(db, { reviewedBefore = null } = {}) {
 }
 
 export function countPendingRows(db) {
-  return countSessionUnchunkedRows(db, { reviewedBefore: Date.now() - CYCLE1_OMITTED_COOLDOWN_MS });
+  return countSessionUnchunkedRows(db, { dueAt: Date.now() });
 }
 
 export function countRawUnchunkedRows(db) {
@@ -115,7 +143,7 @@ export function countRawUnchunkedRows(db) {
  *  classifier prompt. Rows come back newest-first. */
 export async function fetchCycle1Rows(db, plan, now = Date.now()) {
   const sessionFilterSql = plan.onlySessionId ? 'AND session_id = $4' : '';
-  const queryParams = [plan.sessionCap, now - CYCLE1_OMITTED_COOLDOWN_MS, plan.rowsPerSession];
+  const queryParams = [plan.sessionCap, now, plan.rowsPerSession];
   if (plan.onlySessionId) queryParams.push(plan.onlySessionId);
   queryParams.push(plan.backfillCap);
   const backfillParam = `$${queryParams.length}`;
@@ -136,9 +164,8 @@ export async function fetchCycle1Rows(db, plan, now = Date.now()) {
     `WITH eligible_sessions AS (
        SELECT session_id, MAX(ts) AS latest_ts, MAX(id) AS latest_id, MIN(ts) AS oldest_ts
        FROM entries
-       WHERE chunk_root IS NULL
-         AND NULLIF(btrim(session_id), '') IS NOT NULL
-         AND (reviewed_at IS NULL OR reviewed_at < $2)
+       WHERE ${cycle1UnchunkedSql()}
+         AND ${cycle1RowDueSql('$2')}
          ${sessionFilterSql}
        GROUP BY session_id
      ), due_sessions AS (
@@ -162,8 +189,8 @@ export async function fetchCycle1Rows(db, plan, now = Date.now()) {
               ROW_NUMBER() OVER (PARTITION BY e.session_id ORDER BY e.ts DESC, e.id DESC) AS rn
        FROM entries e
        JOIN selected_sessions s ON s.session_id = e.session_id
-       WHERE e.chunk_root IS NULL
-         AND (e.reviewed_at IS NULL OR e.reviewed_at < $2)
+       WHERE ${cycle1UnchunkedSql('e')}
+         AND ${cycle1RowDueSql('$2', 'e')}
      )
      SELECT id, ts, role, content, session_id, source_ref, project_id
      FROM ranked

package/src/runtime/memory/lib/cycle1/cycle1-window.mjs

@@ -66,6 +66,11 @@ async function commitGeneratedChunks(db, generated, signal) {
   const invalidChunks = generated.invalidChunks;
   const invalidRowIds = new Set(invalidChunks.flatMap((chunk) => chunk.member_ids || []));
   const failedRowIds = generated.rawRowIds.filter((id) => invalidRowIds.has(id));
+  // Rows that never got an answer from the classifier, as opposed to rows it
+  // answered badly or left out: these do not lengthen their retry cooldown.
+  const transientRowIds = invalidChunks
+    .filter((chunk) => chunk.reason === 'llm_error')
+    .flatMap((chunk) => chunk.member_ids || []);
   const commitStartedAt = Date.now();
   for (const chunk of generated.chunks) {
     // A chunk commit is one DB transaction; do not split it with an abort
@@ -97,7 +102,10 @@ async function commitGeneratedChunks(db, generated, signal) {
     } catch (err) {
       __mixdogMemoryLog(`[cycle1] chunk commit failed (root=${rootId}): ${err.message}\n`);
       skippedChunks += 1;
-      for (const mid of memberIds) failedRowIds.push(mid);
+      for (const mid of memberIds) {
+        failedRowIds.push(mid);
+        transientRowIds.push(mid);
+      }
     }
   }
   return {
@@ -107,6 +115,7 @@ async function commitGeneratedChunks(db, generated, signal) {
     skippedChunks,
     invalidChunks,
     failedRowIds,
+    transientRowIds,
     commitStartedAt,
   };
 }
@@ -160,7 +169,7 @@ export async function processCycle1Window({ db, rows: originalRows, windowIdx, p
 
   const rawRowIds = rows.map((r) => Number(r.id)).filter((id) => !commit.committedRowIds.has(id));
   const llmOmittedRowIds = rawRowIds.filter((id) => !commit.failedRowIds.includes(id));
-  const omittedMark = await markOmittedRows(db, rawRowIds);
+  const omittedMark = await markOmittedRows(db, rawRowIds, { transientRowIds: commit.transientRowIds });
   const omittedRowIds = llmOmittedRowIds.concat(prefilteredRowIds);
 
   __mixdogMemoryLog(

package/src/runtime/memory/lib/embedding-provider.mjs

@@ -10,6 +10,7 @@ import { fileURLToPath } from 'node:url';
 import { writeProfilePoint } from './model-profile.mjs';
 import { createCompactVectorCache } from './compact-vector-cache.mjs';
 import { EMBED_KEEP_WARM_MS } from './embedding-idle-lease.mjs';
+import { workerExecArgv } from '../../shared/worker-exec-argv.mjs';
 import {
   getConfiguredEmbeddingModelId,
   getDefaultEmbeddingDtype,
@@ -47,11 +48,7 @@ const queryEmbeddingCache = createCompactVectorCache({
 const WORKER_PATH = join(fileURLToPath(import.meta.url), '..', 'embedding-worker.mjs');
 
 export function embeddingWorkerExecArgv(execArgv = process.execArgv) {
-  return (Array.isArray(execArgv) ? execArgv : []).filter((arg) => {
-    const value = String(arg);
-    if (value.startsWith('--input-type')) return false;
-    return !/^--(?:max-old-space-size|max-semi-space-size|initial-old-space-size)(?:=|$)/.test(value);
-  });
+  return workerExecArgv(execArgv);
 }
 
 function embeddingCacheKey(text, inputType, dtype = _configuredDtype) {

package/src/runtime/memory/lib/embedding-reindex.mjs

@@ -20,7 +20,6 @@ function waitForNextPass(ms, signal) {
 
 export async function drainEmbeddingReindex({
   flushEntries,
-  backfillCore = async () => 0,
   signal,
   pauseMs = DEFAULT_PASS_PAUSE_MS,
   wait = waitForNextPass,
@@ -45,8 +44,5 @@ export async function drainEmbeddingReindex({
     await wait(pauseMs, signal);
   }
 
-  throwIfAborted(signal);
-  const coreFilled = Number((await backfillCore({ signal })) ?? 0);
-  throwIfAborted(signal);
-  return { passes, attempted, succeeded, failed, coreFilled };
+  return { passes, attempted, succeeded, failed };
 }

package/src/runtime/memory/lib/http-router/lifecycle-routes.mjs

@@ -61,7 +61,6 @@ export function createLifecycleRoutes({
         archived_roots: stats.archived_roots,
         unchunked_leaves: stats.unchunked_leaves,
         core_entries: stats.core_entries,
-        core_embed_null: stats.core_embed_null,
         cycle_running: cycleScheduler.getCycleRunning(),
         cycle_health: cycleScheduler.getCycleHealth(),
         cycle_backlog: cycleScheduler.getCycleBacklogSnapshot(),

package/src/runtime/memory/lib/memory-action-handlers/maintenance-actions.mjs

@@ -32,7 +32,7 @@ export function createMaintenanceActions({ getDb, entryStats, getCycleLastRun })
       `entries: total=${stats.total} roots=${stats.roots} cycle1_raw=${stats.unchunked_leaves} (unchunked leaves)`,
       `status: ${stats.byStatus.map((r) => `${r.status ?? '?'}:${r.c}`).join(', ') || 'empty'}`,
       `categories: ${stats.byCategory.map((r) => `${r.category ?? 'NULL'}:${r.c}`).join(', ') || 'empty'}`,
-      `core_memory: user=${stats.core_entries} embed_null=${stats.core_embed_null}`,
+      `core_memory: user=${stats.core_entries}`,
       `embedding_index: ready dims=${dims}${dimsErr ? ` (meta_read_error: ${dimsErr})` : ''}`,
       `bootstrap: ${bootstrapComplete ? 'complete' : 'incomplete'}`,
       `last_cycle1: ${agoText(last.cycle1)}`,

package/src/runtime/memory/lib/memory-schema/core-and-meta.mjs

@@ -1,14 +1,14 @@
 /**
- * core-and-meta.mjs — core_entries, the meta key/value table, the cycle
- * state view and the bootstrap stamps that record which embedding model and
- * dimension the schema was built for.
+ * core-and-meta.mjs — core_entries, the meta key/value table and the
+ * bootstrap stamps that record which embedding model and dimension the schema
+ * was built for.
  */
 import { ensureCoreKeyIndex } from '../core-memory-uniqueness.mjs';
 
 const UPSERT_META = `INSERT INTO meta(key, value) VALUES ($1, $2::jsonb)
      ON CONFLICT(key) DO UPDATE SET value = EXCLUDED.value`;
 
-export async function ensureCoreEntriesSchema(db, dimCount) {
+export async function ensureCoreEntriesSchema(db) {
   await db.exec(`
     CREATE TABLE IF NOT EXISTS core_entries (
       id          BIGSERIAL PRIMARY KEY,
@@ -16,16 +16,12 @@ export async function ensureCoreEntriesSchema(db, dimCount) {
       summary     TEXT NOT NULL,
       category    TEXT NOT NULL,
       project_id  TEXT,
-      embedding   halfvec(${dimCount}),
       created_at  BIGINT NOT NULL,
       updated_at  BIGINT NOT NULL
     )
   `);
   await db.exec(`CREATE INDEX IF NOT EXISTS core_entries_project_idx ON core_entries(project_id)`);
   await ensureCoreKeyIndex(db);
-  await db.exec(
-    `CREATE INDEX IF NOT EXISTS core_entries_embedding_hnsw ON core_entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL`
-  );
 }
 
 export async function ensureMetaSchema(db) {
@@ -35,20 +31,6 @@ export async function ensureMetaSchema(db) {
       value  JSONB NOT NULL
     )
   `);
-
-  // Operational view — used by /health and dashboards. One round-trip,
-  // covers the metrics that previously needed 6+ COUNT queries.
-  await db.exec(`
-    CREATE OR REPLACE VIEW v_cycle_state AS
-    SELECT
-      COUNT(*) FILTER (WHERE is_root = 1) AS roots,
-      COUNT(*) FILTER (WHERE is_root = 1 AND status = 'pending')  AS pending,
-      COUNT(*) FILTER (WHERE is_root = 1 AND status = 'active')   AS active,
-      COUNT(*) FILTER (WHERE is_root = 1 AND status = 'archived') AS archived,
-      COUNT(*) FILTER (WHERE chunk_root IS NULL)                  AS unclassified,
-      COUNT(*) AS total
-    FROM entries
-  `);
 }
 
 export async function stampBootstrapMeta(db, dimCount, embeddingIdentity) {

package/src/runtime/memory/lib/memory.mjs

@@ -35,7 +35,7 @@ export async function init(db, dims, embeddingIdentity = null) {
   await ensureScoreSchema(db);
   await ensureEntriesSchema(db, dimCount);
   await ensureEntryTriggers(db);
-  await ensureCoreEntriesSchema(db, dimCount);
+  await ensureCoreEntriesSchema(db);
   await ensureMetaSchema(db);
   await stampBootstrapMeta(db, dimCount, embeddingIdentity);
 }
@@ -61,7 +61,6 @@ async function getEmbeddingColumnDims(db, tableName) {
 
 export async function resetEmbeddingColumnsForModel(db, dimCount, embeddingIdentity = null) {
   const entriesDims = await getEmbeddingColumnDims(db, 'entries');
-  const coreDims = await getEmbeddingColumnDims(db, 'core_entries');
   const normalizedIdentity = embeddingIdentity == null ? null : JSON.stringify(embeddingIdentity);
   let identityChanged = false;
   if (normalizedIdentity != null) {
@@ -72,39 +71,25 @@ export async function resetEmbeddingColumnsForModel(db, dimCount, embeddingIdent
     identityChanged = identity.rows.length === 0 || identity.rows[0].matches !== true;
   }
   const needsEntriesReset = entriesDims != null && (entriesDims !== dimCount || identityChanged);
-  const needsCoreReset = coreDims != null && (coreDims !== dimCount || identityChanged);
-  if (!needsEntriesReset && !needsCoreReset) return false;
+  if (!needsEntriesReset) return false;
 
   __mixdogMemoryLog(
-    `[memory] embedding model changed; resetting vectors for halfvec(${dimCount}) ` +
-      `(entries=${entriesDims ?? 'missing'}, core_entries=${coreDims ?? 'missing'})\n`
+    `[memory] embedding model changed; resetting vectors for halfvec(${dimCount}) (entries=${entriesDims})\n`
   );
 
   // Old installations may still have a derived view depending on embedding.
   // Release that dependency only during a model migration; never recreate it.
   await db.exec(`DROP MATERIALIZED VIEW IF EXISTS mv_hot_active CASCADE`);
   await db.exec(`DROP INDEX IF EXISTS idx_entries_embedding_hnsw`);
-  await db.exec(`DROP INDEX IF EXISTS core_entries_embedding_hnsw`);
 
-  if (needsEntriesReset) {
-    if (entriesDims !== dimCount) {
-      await db.exec(
-        `ALTER TABLE entries ALTER COLUMN embedding TYPE halfvec(${dimCount}) USING NULL::halfvec(${dimCount})`
-      );
-    } else {
-      await db.exec(`UPDATE entries SET embedding = NULL WHERE embedding IS NOT NULL`);
-    }
-    await db.exec(`UPDATE entries SET summary_hash = NULL WHERE summary_hash IS NOT NULL`);
-  }
-  if (needsCoreReset) {
-    if (coreDims !== dimCount) {
-      await db.exec(
-        `ALTER TABLE core_entries ALTER COLUMN embedding TYPE halfvec(${dimCount}) USING NULL::halfvec(${dimCount})`
-      );
-    } else {
-      await db.exec(`UPDATE core_entries SET embedding = NULL WHERE embedding IS NOT NULL`);
-    }
+  if (entriesDims !== dimCount) {
+    await db.exec(
+      `ALTER TABLE entries ALTER COLUMN embedding TYPE halfvec(${dimCount}) USING NULL::halfvec(${dimCount})`
+    );
+  } else {
+    await db.exec(`UPDATE entries SET embedding = NULL WHERE embedding IS NOT NULL`);
   }
+  await db.exec(`UPDATE entries SET summary_hash = NULL WHERE summary_hash IS NOT NULL`);
 
   await db.exec(`DROP TABLE IF EXISTS memory.embedding_cache`);
   await setMetaValue(db, 'embedding.current_dims', JSON.stringify(dimCount));
@@ -244,12 +229,78 @@ async function removeRuntimeNotificationRowsOnce(db) {
   }
 }
 
+// One-time cleanup: what the relationship-review and promotion cycles left in
+// a database they once ran on. Nothing reads any of it, and its indexes were
+// still maintained on every write:
+//   entries columns  the five below, with the indexes on them
+//   indexes          idx_entries_phase_sweep, idx_entries_reviewed_at, idx_roots_active
+//   relations        mv_hot_active, phase_merge_verdicts, and the v_cycle_state
+//                    view that every store created and nothing queried
+//   meta             both cycles' scheduling rows and last-run keys,
+//                    memory.generated.policy.*, memory.authority-review
+// The entry triggers are recreated first: such a database still lists
+// promoted_at in the score trigger's UPDATE OF columns, which would block
+// dropping that column. One transaction, gated by a meta flag like the
+// notification cleanup above; best-effort so a failure never blocks boot.
+const CYCLE_STATE_CLEANUP_META_KEY = 'cleanup.review_promotion_cycle_state_v1';
+const CYCLE_STATE_ENTRY_COLUMNS = [
+  'cycle2_reviewed_at',
+  'core_summary',
+  'promoted_at',
+  'core_candidate_status',
+  'core_candidate_at',
+];
+async function removeReviewAndPromotionCycleStateOnce(db) {
+  try {
+    const already = await db.query(`SELECT 1 FROM meta WHERE key = $1`, [CYCLE_STATE_CLEANUP_META_KEY]);
+    if (already?.rows?.length) return;
+    const columns = await db.query(
+      `SELECT column_name FROM information_schema.columns
+       WHERE table_schema = current_schema() AND table_name = 'entries' AND column_name = ANY($1::text[])`,
+      [CYCLE_STATE_ENTRY_COLUMNS]
+    );
+    let metaRows = 0;
+    await db.transaction(async (tx) => {
+      await ensureEntryTriggers(tx);
+      await tx.exec(`DROP MATERIALIZED VIEW IF EXISTS mv_hot_active`);
+      await tx.exec(`DROP VIEW IF EXISTS v_cycle_state`);
+      await tx.exec(
+        `ALTER TABLE entries ${CYCLE_STATE_ENTRY_COLUMNS.map((name) => `DROP COLUMN IF EXISTS ${name}`).join(', ')}`
+      );
+      await tx.exec(`DROP INDEX IF EXISTS idx_entries_phase_sweep, idx_entries_reviewed_at, idx_roots_active`);
+      await tx.exec(`DROP TABLE IF EXISTS phase_merge_verdicts`);
+      const deleted = await tx.query(
+        `DELETE FROM meta
+         WHERE key ~ '^cycle_(request|schedule)\\.cycle[23]\\.'
+            OR key LIKE 'memory.generated.policy.%'
+            OR key = 'memory.authority-review'`
+      );
+      metaRows = Number(deleted?.rowCount ?? 0);
+      await tx.exec(
+        `UPDATE meta SET value = value - ARRAY['cycle2', 'cycle2_last_error', 'cycle3', 'cycle3_last_error']
+         WHERE key = 'state.cycle_last_run' AND jsonb_typeof(value) = 'object'`
+      );
+      await setMetaValue(tx, CYCLE_STATE_CLEANUP_META_KEY, JSON.stringify('1'));
+    });
+    const dropped = (columns?.rows || []).map((row) => row.column_name);
+    if (dropped.length || metaRows > 0) {
+      __mixdogMemoryLog(
+        `[memory] ensureCurrentSchemaExtensions: removed review/promotion cycle state (columns=${dropped.join(',') || 'none'}, meta rows=${metaRows})\n`
+      );
+    }
+  } catch (err) {
+    __mixdogMemoryLog(`[memory] review/promotion cycle cleanup failed: ${err?.message || err}\n`);
+  }
+}
+
 export async function ensureCurrentSchemaExtensions(db, dims, embeddingIdentity = null) {
   await removeAttachmentPlaceholderRows(db);
   await removeRuntimeNotificationRowsOnce(db);
-  // User-curated entries retain their own embeddings for explicit retrieval.
+  await removeReviewAndPromotionCycleStateOnce(db);
+  // User-curated entries are injected verbatim and recalled by term match;
+  // drop the vector column (and its index) older versions maintained.
+  await db.exec(`ALTER TABLE core_entries DROP COLUMN IF EXISTS embedding`);
   if (Number.isInteger(dims) && dims > 0) {
-    await db.exec(`ALTER TABLE core_entries ADD COLUMN IF NOT EXISTS embedding halfvec(${dims})`);
     // One-time migration for EXISTING deployments (bootstrap-complete DBs never
     // re-run init(), so the broadened index definitions there would otherwise
     // never reach them). This path runs on EVERY boot, so we must NOT
@@ -260,13 +311,9 @@ export async function ensureCurrentSchemaExtensions(db, dims, embeddingIdentity
     await db.exec(
       `CREATE INDEX IF NOT EXISTS idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL`
     );
-    await db.exec(
-      `CREATE INDEX IF NOT EXISTS core_entries_embedding_hnsw ON core_entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL`
-    );
   }
   await db.exec(`ALTER TABLE entries ADD COLUMN IF NOT EXISTS chunk_quality jsonb`);
-  // Existing retired review metadata is left untouched, but no longer created.
-  // Preserve the search relationships used by recall.
+  // The search relationships used by recall.
   await db.exec(
     `ALTER TABLE entries ADD COLUMN IF NOT EXISTS duplicate_of bigint REFERENCES entries(id) ON DELETE SET NULL`
   );

package/src/runtime/memory/lib/query-maintenance-handlers.mjs

@@ -151,7 +151,6 @@ export function createQueryMaintenanceHandlers({ getDb }) {
       ).rows[0].c;
       const unchunked_leaves = (await tx.query(`SELECT COUNT(*) c FROM entries WHERE chunk_root IS NULL`)).rows[0].c;
       const core_entries = (await tx.query(`SELECT COUNT(*) c FROM core_entries`)).rows[0].c;
-      const core_embed_null = (await tx.query(`SELECT COUNT(*) c FROM core_entries WHERE embedding IS NULL`)).rows[0].c;
       const byStatus = (await tx.query(`SELECT status, COUNT(*) c FROM entries WHERE is_root = 1 GROUP BY status`))
         .rows;
       const byCategory = (
@@ -164,7 +163,6 @@ export function createQueryMaintenanceHandlers({ getDb }) {
         archived_roots,
         unchunked_leaves,
         core_entries,
-        core_embed_null,
         byStatus,
         byCategory,
       };

package/src/runtime/office/com/com-adapter.mjs

@@ -331,6 +331,9 @@ export async function callMicrosoftOffice(payload, { timeoutMs = DEFAULT_TIMEOUT
 }
 
 export async function detectMicrosoftOffice({ format = '', path = '' } = {}) {
+  // Off Windows there is no COM to probe; spawning powershell.exe only reported
+  // "spawn powershell.exe ENOENT" as if Office were broken on a Mac.
+  if (!microsoftOfficeComSupported()) return unsupportedPlatformResult();
   return await callMicrosoftOfficeOnce({ action: 'detect', format, path }, { timeoutMs: 20_000 });
 }
 

package/src/runtime/office/pdf/pdf-adapter.mjs

@@ -51,18 +51,49 @@ function metadataOf(structure) {
   };
 }
 
+// pdf-lib cannot decrypt. An encrypted file that keeps its page tree in
+// ciphered object streams — what qpdf and most current writers produce —
+// therefore reads as having no page tree at all; null says so.
+function structurePageCount(structure) {
+  try {
+    return structure.getPageCount();
+  } catch (error) {
+    if (!structure.isEncrypted) throw error;
+    return null;
+  }
+}
+
+// pdf.js decrypts: with the user password, or with none under an owner-only
+// lock. Null when the file is locked and no working password was given.
+async function decryptedPageCount(buffer, password) {
+  try {
+    return (await inspectPdfBuffer(buffer, { password })).pageCount;
+  } catch (error) {
+    if (!/password/i.test(String(error?.message || error?.name || ''))) throw error;
+    return null;
+  }
+}
+
 export async function snapshotPdf(path, options = {}) {
   const maxChars = Math.max(1_000, Number(options.maxChars) || 30_000);
   const buffer = await readFile(path);
   const structure = await loadPdf(buffer, { allowEncrypted: true });
-  const encrypted = structure.isEncrypted === true;
-  const pageCount = structure.getPageCount();
+  const encrypted = structure.isEncrypted;
+  const structurePages = structurePageCount(structure);
+  const pageCount = structurePages ?? (await decryptedPageCount(buffer, options.password || ''));
+  const knownPages = pageCount ?? 0;
   const offset = options.paged ? Math.max(0, Number(options.offset) || 0) : 0;
-  const limit = options.paged ? Math.max(1, Number(options.limit) || 20) : pageCount;
-  const selected =
-    Array.isArray(options.pages) && options.pages.length
-      ? options.pages.map(Number)
-      : Array.from({ length: Math.max(0, Math.min(limit, pageCount - offset)) }, (_, index) => offset + index + 1);
+  const limit = options.paged ? Math.max(1, Number(options.limit) || 20) : knownPages;
+  // A locked file whose pages could not be counted selects none.
+  let selected = [];
+  if (pageCount !== null && Array.isArray(options.pages) && options.pages.length) {
+    selected = options.pages.map(Number);
+  } else if (pageCount !== null) {
+    selected = Array.from(
+      { length: Math.max(0, Math.min(limit, pageCount - offset)) },
+      (_, index) => offset + index + 1
+    );
+  }
   for (const index of selected) {
     if (!Number.isInteger(index) || index < 1 || index > pageCount) throw new Error(`PDF page out of range: ${index}`);
   }
@@ -73,7 +104,7 @@ export async function snapshotPdf(path, options = {}) {
   try {
     result = await inspectPdfBuffer(buffer, {
       extractText: true,
-      maxPages: Math.max(500, pageCount),
+      maxPages: Math.max(500, knownPages),
       maxOutputBytes: maxChars,
       pageRange: { from, to },
       password: options.password || '',
@@ -94,7 +125,8 @@ export async function snapshotPdf(path, options = {}) {
       path: `/page[${index}]`,
       index,
       text: (texts.get(index) ?? '').replace(/ {2,}/g, ' '),
-      ...pageGeometry(structure, index),
+      // A ciphered page tree has no page boxes to read.
+      ...(structurePages === null ? {} : pageGeometry(structure, index)),
     }));
   // Strings and streams stay ciphered under ignoreEncryption, so the form and
   // attachment views of an encrypted file would be noise rather than data.
@@ -113,7 +145,10 @@ export async function snapshotPdf(path, options = {}) {
         path: `/outline[${index + 1}]`,
         ...entry,
       }));
-    } catch {}
+    } catch {
+      // The outline is a convenience view; an unreadable one leaves it empty
+      // rather than failing the snapshot of a readable document.
+    }
   }
   const likelyScannedPages = passwordRequired
     ? []
@@ -137,7 +172,7 @@ export async function snapshotPdf(path, options = {}) {
     ocrRequired: likelyScannedPages.length > 0,
     encrypted,
     ...(encrypted ? { passwordRequired, hint: PDF_ENCRYPTED_HINT } : {}),
-    ...(options.paged ? { pagination: pagePagination(options, offset, limit, pages.length, pageCount) } : {}),
+    ...(options.paged ? { pagination: pagePagination(options, offset, limit, pages.length, knownPages) } : {}),
   };
 }
 
@@ -188,12 +223,13 @@ export async function applyPdfBatch(path, operations, context = {}) {
 }
 
 export async function validatePdf(path) {
-  const document = await loadPdf(await readFile(path), { allowEncrypted: true });
-  const encrypted = document.isEncrypted === true;
+  const buffer = await readFile(path);
+  const document = await loadPdf(buffer, { allowEncrypted: true });
+  const encrypted = document.isEncrypted;
   return {
     ok: true,
     format: 'pdf',
-    pages: document.getPageCount(),
+    pages: structurePageCount(document) ?? (await decryptedPageCount(buffer, '')),
     validation: 'pdf-parse',
     encrypted,
     ...(encrypted ? { warning: PDF_ENCRYPTED_HINT } : {}),

package/src/runtime/office/pdf/pdf-render.mjs

@@ -4,6 +4,7 @@ import { isMainThread, parentPort, Worker, workerData } from 'node:worker_thread
 import { createCanvas, loadImage } from '@napi-rs/canvas';
 import { pdfjsStandardFontDataUrl, resolvedPdfJs } from '../../attachments/pdfjs-runtime.mjs';
 import { installPdfGlobals } from './pdf-document.mjs';
+import { workerExecArgv } from '../../shared/worker-exec-argv.mjs';
 
 const PAGE_NUMBER_PATTERN = /^\s*(?:(?:page\s*)?\d+\s*(?:of|\/)\s*\d+|페이지\s*\d+|\d+\s*페이지)\s*$/i;
 
@@ -110,12 +111,7 @@ async function renderPdfPageDirect(path, pageNumber, targetWidth, minimumScale =
 
 async function runPdfRenderWorker(data, signal = null) {
   const worker = new Worker(new URL(import.meta.url), {
-    execArgv: process.execArgv.filter(
-      (argument) =>
-        !/^--(?:input-type|max-old-space-size|max-semi-space-size|stack-size|heapsnapshot-near-heap-limit)(?:=|$)/.test(
-          argument
-        )
-    ),
+    execArgv: workerExecArgv(),
     workerData: data,
   });
   return await new Promise((resolve, reject) => {

package/src/runtime/office/pdf/pdf-security.mjs

@@ -74,15 +74,21 @@ export async function securePdf({ input, output, mode, password = '', ownerPassw
       'PDF encryption/decryption requires qpdf on PATH (or MIXDOG_QPDF_PATH) and it is not installed (Windows: winget install qpdf; macOS: brew install qpdf; Debian/Ubuntu: apt install qpdf); tell the user the file was left as is'
     );
   }
+  // Passwords travel in a response file, never on the command line where other
+  // processes can read them. qpdf takes each line of it as one literal
+  // argument — spaces and quotes included, no unquoting — so a line break is
+  // the one character a password cannot carry.
+  if (/[\r\n]/.test(`${password}${ownerPassword}`)) {
+    throw new Error('PDF passwords cannot contain line breaks; the file was left as is');
+  }
   const samePath = input.toLowerCase() === output.toLowerCase();
   const target = samePath ? join(dirname(output), `.mixdog-qpdf-${randomUUID()}.pdf`) : output;
   const responsePath = join(dirname(target), `.mixdog-qpdf-${randomUUID()}.args`);
-  const quote = (value) => `"${String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
   const args =
     mode === 'encrypt'
       ? ['--encrypt', password, ownerPassword || password, '256', '--', input, target]
       : [`--password=${password}`, '--decrypt', input, target];
-  await writeFile(responsePath, `${args.map(quote).join('\n')}\n`, { encoding: 'utf8', mode: 0o600 });
+  await writeFile(responsePath, `${args.join('\n')}\n`, { encoding: 'utf8', mode: 0o600 });
   try {
     await run(QPDF, [`@${responsePath}`]);
     if (samePath) await rename(target, output);